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Figure 1 
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a client attempts to invoke 
a method on a server 
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client's security API sends authenticating 
information to authentication authority 



authentication authority verifies 
authenticating information 
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authentication authority 
creates token 



authentication authority returns token 
to client's security API 
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client's application API invokes method on server 
and passes along the token 



server's application API extracts 
security information from token 



server's security API calls 
authentication authority to validate token 
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authentication authority 
validates token 
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authentication authority returns 
validation to server's security API 
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server's application API extracts 
information about client from token 
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server's application API determines if client 
can invoke method on server 



method invocation 
occurs 
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Figure 2 



